A record accessor is Fluent Bit expression syntax for selecting event-record data and reserved metadata while filters evaluate conditions or construct configuration values. Prefix references with $, then traverse JSON payloads through quoted field names or indexes in square brackets. section 7.4.1
Use record accessors to:
- Read reserved values such as the current event tag with $tag. section 7.4.1
- Read root-level JSON fields such as $remote_ip. section 7.4.1
- Traverse nested fields, such as $request['verb'], using JSONPath-style bracket notation. section 7.4.1
- Build rewritten tags by combining literal text with string-valued record references. section 7.4.2
Constructing a routed tag
For a record whose request verb is GET, the rewrite_tag rule can construct Apps.GET.onSrv.Watts with $TAG.$request['verb'].onSrv.$Hostname. A true final Boolean keeps the original event and emits a clone; false changes the tag instead. section 7.4.2
{
"time": "12/May/2023:08:05:52 +0000",
"remote_ip": "10.4.72.163",
"remote_user": "-",
"request": {
"verb": "GET",
"path": " /downloads/product_2",
"protocol": "HTTP",
"version": "1.1"
},
"response": 304,
"bytes": 0,
"referrer": "-",
"agent": "Mozilla/5.0 (0.9.7.9)"
}
Inspect the JSON event structure used for root-level and nested accessor examples, including remote_ip, request.verb, response, and other fields. section 7.4.1
Missing fields return no value: the operation takes no action, leaves the record unchanged, and lets later pipeline steps continue. Support exists only in a subset of plugins, and rewrite-tag construction requires string-valued references. section 7.4.1 section 7.4.2
